PaperlayerView exact revision on arXiv

Source-linked AI summary

What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chains

Wei-Liang Liu, Cheng-Yen Tsai

arXiv:2610.19498v1cs.CRcs.LG

TL;DR

Model signing authenticates full-precision weights, but current disclosures do not uniquely determine the quantized artifact users run. The paper measures independent bit-exact verifiability and tests which omitted inputs enable re-derivation. It finds zero recorded-inputs IVR in the sampled repositories, while supplying build coordinates reproduces most tested quantized files.

  • Problem

    Current disclosures do not uniquely determine quantized artifacts from signed full-precision weights, leaving the fraction of independently bit-exact re-derivable GGUF artifacts unmeasured.

    Source: §I · p. 1

  • Method

    The paper measures recorded-inputs IVR and trials bit-exact re-derivation while varying disclosed quantization inputs and execution-environment coordinates.

    Source: §I · p. 2, §IV · p. 4

  • Results

    0/198 repositories satisfy recorded-inputs IVR, while supplying omitted coordinates re-derives 7/8 target–quant files on x86 and one compiler setting yields ∆PPL +0.06%.

    Source: §I · pp. 1–2

  • Takeaways & Limitations

    Trustless re-derivation requires an ambiguity-free transformation, B=0, over the environments a verifier must allow.

    Source: §I · p. 2

    The evaluated statistics are evaded by targeted embedding edits, and adversarial-fp16 attacks are outside the evaluation; the audit includes a 12-card sample alongside a scan of 198 cards.

    Source: §VIII · p. 11

Abstract

from arXiv · show

Model signing authenticates the full-precision weights W an LLM is released with, yet users run a quantized artifact Q whose producing transformation is not uniquely determined under current disclosure. We separate the non-environment inputs from the execution environment E and measure a quantity that, to our knowledge, has not been measured before: the Independent Verifiability Rate (IVR), the fraction of a popularity-sampled GGUF ecosystem that a third party can re-derive bit-for-bit. Across the 200 most-downloaded Hugging Face GGUF repositories (198 in scope), no artifact or model card records the build environment, so under a recorded-inputs protocol the IVR is 0/198. Yet the artifacts are not irreproducible. On four in-sample repositories that disclose their inputs, the card's information alone reproduces no Q4_K_M file, but two coordinates the card omits - the build's floating-point-contraction setting and, for hybrid models, the per-tensor quantization recipe - re-derive 7/8 target-quant files bit-for-bit on x86 (5/8 on arm64); the fp16 re-derives from the provider's checkpoint, but the calibration imatrix must be shipped and hash-bound, since recomputing it did not match. An older release additionally pins the instruction set and did not re-derive. Reproducing the divergence reported with llama.cpp PR #25353, we show that E is a necessary coordinate and that one compiler setting yields a unique output across the tested platforms at negligible quality cost (+0.06% perplexity). As a security characterization, benign floating-point non-determinism separates from uniformly placed nibble-flip tampering above a detection floor that grows with the environments a verifier must allow, but a targeted embedding edit evades the statistic, so the proposed protocol rests on exact re-derivation; adversarial-fp16 attacks lie outside it. We release the audit data and a re-runnable harness.

I. INTRODUCTION

Signed full-precision weights do not uniquely determine the quantized artifacts users run, and current GGUF disclosures leave the transformation’s execution environment unspecified. The paper measures this gap and shows that supplying omitted build coordinates enables bit-exact re-derivation for most tested files.

I. INTRODUCTION

  • 0/198 repositories satisfy the recorded-inputs IVR protocol, although 148/198 are source-reconstructible under the census rule.The zero measures insufficient disclosure, not mathematical irreproducibility; GGUF has no field for the build environment.Source: §I · pp. 1–2
  • 7/8 target–quant files re-derive bit-for-bit on x86 when the build’s FP-contraction setting and hybrid models’ per-tensor recipe are supplied.The card’s disclosed inputs alone reproduce none of the Q4_K_M files.Source: §I · p. 2
  • E is necessary under the studied model, while one compiler setting yields B=0 across tested platforms at a ∆PPL cost of +0.06%.The setting is not the llama.cpp default, and the divergence is in the weight representation rather than inert metadata.Source: §I · p. 2
  • Detection of uniformly placed nibble flips has a floor that grows with allowed build-environment variation, and targeted embedding edits evade the evaluated statistics.The proposed protocol therefore relies on exact re-derivation; adversarial-fp16 attacks lie outside its scope.Source: §I · p. 2
  • An ambiguity-free transformation (B=0) is the protocol’s precondition for trustless re-derivation.Uniform partial spot-checking of m tampered units within N needs Θ(N/m) openings for fixed detection probability.Source: §I · p. 2
  • The paper’s contribution is measuring disclosure shortfalls and identifying the omitted coordinates that a re-derivation manifest must bind.Deterministic GGUF re-derivation and the floating-point-contraction fix are existing engineering; the paper measures the boundary they presuppose.Source: §I · p. 2

II. BACKGROUND & THREAT MODEL

Reproducible builds make shipped binaries independently checkable by rebuilding in a recorded environment, but quantized-model outputs can vary with numeric execution details. Model-signing and attestation efforts bind artifacts or provenance, while the paper’s threat model distinguishes provenance from proving that a quantized artifact faithfully follows signed weights.

II. BACKGROUND & THREAT MODEL

  • Reproducible builds compare a rebuilt binary with the shipped one under a recorded environment, normalizing metadata or recording environment details that affect output.For quantization, normalization cannot remove the observed variation because it lies in numeric weight content.Source: §II · pp. 2–3
  • Model-signing and lifecycle specifications bind released-file hashes or provenance, but do not require binding the imatrix as a quantization input or fully describe the build environment.A quantization-tool hash identifies a binary but does not let a verifier on another platform recreate an equivalent build.Source: §II · p. 3
  • A deployed GGUF is Q = T(¯X; E), with ¯X comprising weights, recipe, calibration input, and non-weight components, and E denoting the execution environment.The imatrix is itself a pipeline output, C = C(W, D, EC), so binding it by hash matters.Source: §II · p. 3
  • GGUF k-quants store low-bit codes and block scales, with a floating-point scale search minimizing imatrix-weighted reconstruction error when an imatrix is supplied.Floating-point environment differences can change chosen scales and stored bytes; changing a code or scale has different weight-space effects.Source: §II · p. 3
  • A manifest committing to (H(W), θ, C, E, M) lets third parties recompute the quantization step, but a committed C does not establish that the imatrix is benign.For a pilot repository, the published fp16 was also reproduced bit-for-bit from the provider’s checkpoint.Source: §II · p. 3
  • A signature over Q establishes provenance, not faithfulness to signed W; faithfulness requires recomputing Q from W and comparing hashes.When honest recomputations can diverge, there is no canonical H(Q) for a verifier to compare against.Source: §II · pp. 3–4

III. TRANSFORMATION AMBIGUITY

The paper separates non-environment inputs from execution environments and formalizes when those inputs determine a unique serialized output. This vocabulary makes explicit why complete re-derivation specifications must constrain the environment.

III. TRANSFORMATION AMBIGUITY

  • The non-environment input ¯X consists of (W, θ, C, M), while the full input adds execution environment E.E ranges over admissible execution environments.Source: §III · p. 4
  • The admissible-output set A(¯X) contains outputs over allowed environments, and B(¯X) is a 0/1 indicator of whether those serialized outputs are non-unique.B=0 exactly when the output set has one element, enabling hash comparison.Source: §III · p. 4
  • Every minimal complete specification must constrain E, while the full characterization of such a specification is left open.Restricting the environments considered can achieve B=0 either by replicating a fully recorded environment or using a setting under which tested environments agree.Source: §III · p. 4

IV. M1: THE INDEPENDENT VERIFIABILITY RATE

Under the recorded-inputs protocol, none of the 198 sampled GGUF repositories is independently verifiable, although many have obtainable source weights and calibration data. Trial re-derivations show that omitted build and recipe details, and an exact calibration input, determine whether deployed files can be reproduced.

Sampling frame

  • The popularity sample freezes the 200 most-downloaded Hugging Face GGUF repositories; two expose no GGUF weight file, leaving 198 repositories in scope.The ranking uses the API’s trailing 30-day download count, and the frozen list can be re-scored against live metadata.Source: §IV · p. 4

Measurement

  • The census checks whether full-precision weights, calibration imatrix, quantizer/version, and execution-environment coordinates are recorded; bit-exact verification requires all four inputs.Source-reconstructibility requires only the weights and imatrix, while the study verifies fp16-to-quantized GGUF rather than upstream conversion.Source: §IV · pp. 4–5

Result

  • 0/198 repositories satisfy the recorded-inputs protocol, although 148/198 are source-reconstructible under the census rule and 111/198 ship full-precision GGUF themselves.The universal recorded-input gap is the build environment; the source-reconstructible counts ignore it.Source: §IV · p. 5
  • The table’s text-and-multimodal-LLM restriction still yields IVR = 0/165.This restriction excludes speech, video, image-generation, embedding, and classification models.Source: Table II · p. 5

Trial re-derivation

  • With card-disclosed inputs alone, no Q4_K_M file re-derives; supplying the per-tensor recipe and FP-contraction setting reproduces 7/8 target–quant files on x86 and 5/8 on arm64.An older release additionally pins the SIMD instruction set and did not re-derive in the tested configurations.Source: §IV · p. 6, Table III · p. 6

Calibration input

  • Recomputing the 0.8B model’s imatrix produced 0/186 bit-identical entries, and using it changed 141/335 tensors, so the exact imatrix must be obtained and hash-bound.The published imatrix’s structure and token counts matched, but its accumulated importance values did not.Source: §IV · pp. 6–7

V. M2: LOCATING THE AMBIGUITY

Default builds can produce different quantized weights across tested environments because floating-point contraction changes scale-search results. Disabling contraction restores bit-identity across the tested platforms and compilers, with negligible measured quality cost, but the setting remains an environment coordinate.

Cause and localization

  • Floating-point contraction in the k-quant scale-search loop can select different block scales near ties, changing packed nibbles and the weight bytes.The GGUF metadata region remains bit-identical; divergence is concentrated in scale parameters and propagates into packed nibbles.Source: §V · pp. 7–8

Scale trend

  • The divergent-byte fraction grows across 1.5B, 7B, and 14B models, using a direct cross-architecture comparison at 1.5B and a single-machine proxy at larger sizes.At 1.5B, the proxy compares the same byte streams as the cross-architecture pair.Source: §V · p. 8, Figure 2 · p. 8

Observation 1

  • For the studied llama.cpp k-quant family, at least one fixed-input instance yields different honest outputs across environments, so a complete specification must constrain E.The empirical necessity claim is limited to the studied model; the experiments do not characterize every sufficient environment specification.Source: §V · p. 8

Scope

  • GPU-native GPTQ/AWQ pipelines may lack B=0 and fall to attestation, while GPU builds and possible GPU imatrix reduction effects were not tested.llama.cpp quantization itself runs CPU code, including in CUDA-enabled builds.Source: §V · p. 8

Cross-architecture divergence

  • 3 of 4 quantization types byte-differ across architectures by default, while -ffp-contract=off restores bit-identity for 4/4 tested types at ∆PPL +0.06%.The perplexity comparison is for Qwen2.5-1.5B-Instruct Q4_K_M on wikitext-2; the paired standard error was 0.005.Source: §V · pp. 7–8, Figure 2 · p. 8

VI. M3: SECURITY CHARACTERIZATION

The security characterization finds that benign cross-environment variation and uniformly placed nibble flips differ in magnitude, but detection floors rise as verifiers allow more environments. Adaptive targeted edits can evade the statistics, so the protocol relies on exact re-derivation when available.

a) Two signatures

  • Benign Q4 K drift touches 0.22% of weights with median |∆w|/σ = 0.014, while uniformly placed Q4 K flips have median |∆w|/σ ≈0.27.One-step flips are roughly 20× larger in magnitude, but adaptive placement into small-scale blocks can make individual steps smaller.Source: §VI · p. 8

b) Separation and detection floor

  • At a known-release arm64 contraction pair, detection floors are 0.02% for Q4 K, 0.005% for Q5 K, 0.05% for Q6 K, and 0.005% for IQ4 XS.Each floor exceeds natural boundary-crossing noise; one budget step above each floor gives TPR 1.0 at FPR 1% in every seed.Source: §VI · p. 9

c) Environment-dependent floor

  • With five-pair calibration, the model-level rule flags every tampered model from 0.2% of weights upward across every pair and seed.The calibrated threshold raises no alarm on the five known-release pairs or the held-out published artifact; hiding capacity grows as the verifier allows more environments.Source: §VI · p. 9
  • Across Q4 K environment pairs, benign weights exceeding τ range from 0.018% to 0.13–0.19%, and the per-tensor floor rises from 0.02% to 0.1%.Changing τ among 0.05, 0.1, and 0.2 preserves pair ordering and flags no honest artifact.Source: §VI · p. 9

d) Sparse large edits

  • The tail fraction catches many small edits, while the maximum |∆w|/σ catches sparse large edits; staying below both requires few, small changes.Honest Q4 K artifacts reach at most 2.36, whereas one farthest-code edit reaches 2.40–2.52 across seeds and pairs.Source: §VI · p. 9

e) Scope

  • Adaptive placement hides up to 0.43% of Q4 K weights from all three statistics, whereas the same number of uniformly placed flips is caught.The hidden edits are the lowest-magnitude choices and have about 4–8× less total weight change than uniform placement; the evaluation covers uniform untargeted edits on one model family.Source: §VI · p. 9

f) Targeted attack

  • A targeted embedding edit can flip a greedy next token while every edit remains below τ, evading all three statistics, although one row is not always sufficient.The authors therefore treat the statistics as characterizing benign and untargeted regimes, not as a guarantee against targeted cheating quantizers.Source: §VI · pp. 9–10

g) Threat boundary

  • Adversarial-fp16 attacks lie outside this analysis because the publisher honestly quantizes a maliciously prepared fp16, which re-derivation reproduces exactly.The signed W is itself the attack, rather than a deviation introduced by a cheating quantizer.Source: §VI · p. 10

VII. VERIFICATION PROTOCOL

The protocol makes exact re-derivation the preferred verification path by requiring an unambiguous transformation and a manifest of its inputs. When deterministic builds are unavailable, partial checking has a cost that grows as tampering becomes sparse.

Verification recommendation

  • When B=0, an independent rebuilder can recompute Q and compare hashes to detect any deviation, assuming committed inputs and the hash are sound.If plausible environments form a small known set, a verifier can instead accept any output in that set; without recorded E, the set is unknown.Source: §VII · p. 10

Deterministic quantization

  • One compiler flag yields B=0 across the tested platforms at negligible measured quality cost, but architecture must still be recorded or zero blocks canonicalized.At b9222, a Q8_0 tensor with all-zero blocks still stores architecture-dependent codes; B=0 is therefore an empirical property of tested pairs, releases, and types.Source: §VII · p. 10

Manifest and transparency log

  • The quantizer signs a manifest committing to H(W), θ, C, E, and M; independent rebuilders recompute Q and publish signed match or mismatch results to an append-only log.The specified inputs include the FP-contraction setting, per-tensor recipe, and a hash of the exact imatrix, which could not be recomputed on tested CPUs.Source: §VII · p. 10

Partial verification trade-off

  • Uniform spot-checking needs Θ(N/m) openings to maintain fixed detection probability against m tampered units among N, approaching full re-derivation for sparse tampering.The protocol favors full re-derivation when reproducible and leaves attestation as a residual mechanism when it is unavailable.Source: §VII · pp. 10–11

VIII. DISCUSSION & LIMITATIONS

The discussion frames the contribution as an ecosystem measurement and a specification of what quantized-model verification must bind. Its empirical scope is limited, and the authors identify GPU pipelines and adversarial-fp16 attacks as outside the evaluated protocol.

Contribution and scope

  • The contribution includes measuring the ecosystem, locating divergence in quantization, identifying omitted build coordinates and imatrix inputs, and characterizing the B>0 security regime.The authors distinguish this work from ggufpacker and PR #25353 by its measurement and decomposition of the verification problem.Source: §VIII · p. 11

Limitations

  • The evaluation covers Qwen 0.5B–14B, one Granite 3B, selected quantization types, and CPU llama.cpp quantization; GPU imatrix generation and GPU-native pipelines are out of scope.Adversarial-fp16 attacks are also outside the transformation-level checks, and the 12-card audit is complemented by a pattern scan of 198 cards.Source: §VIII · p. 11

Recommendations

  • The authors recommend recording quantizer versions and build flags in llama.cpp/GGUF, merging PR #25353, and requiring C and E in IETF/ML-BOM.The discussion identifies these as recommendations based on the measured verification requirements.Source: §VIII · p. 11

IX. RELATED WORK

The related-work discussion connects quantized-model verification to reproducible builds, signing and attestation, quantization-time attacks, and inference verification. It distinguishes re-deriving the transformation that produces a model from verifying inference that consumes it.

Reproducible builds

  • Reproducible-builds work establishes independently verifiable source-to-binary correspondence; this paper applies that lens to quantization, where environment information must be recorded or made irrelevant.The authors report that neither is current practice in the studied setting.Source: §IX · p. 11

Model signing and attestation

  • Existing signing authenticates released-file identity, while examined lifecycle and provenance specifications do not require the specific calibration artifact C or recreatable execution-environment details.The paper proposes an in-toto-style manifest and transparency log, and notes SLSA provenance has generic slots that could carry C and E.Source: §IX · p. 11

Quantization-time attacks

  • Adversarially prepared full-precision models that behave maliciously after honest quantization fall outside the cheating-quantizer threat model because re-derivation reproduces them.Targeted rounding-guided injection [19] and bit-flip attacks [32] are instead identified as relevant attacks against the paper’s statistics.Source: §IX · p. 12

Verifying ML computation

  • Inference verification methods check the computation that consumes a deployed model, whereas this paper checks the transformation that produces it.The discussion distinguishes inference verification and deterministic-inference work from quantization re-derivation.Source: §IX · p. 12

X. CONCLUSION

The conclusion says current ML supply-chain disclosure does not support independent bit-exact verification, while deterministic quantization and recording build inputs can close the environment gap for the studied llama.cpp pipeline on tested platforms. It also delineates security boundaries, reports the study’s ethical scope, and provides audit materials and disclosures about LLM use.

X. CONCLUSION

  • The recorded-inputs IVR is 0/198, and environment search re-derived recent releases but not an older one.For newly produced artifacts on tested platforms, deterministic quantization and recording the release and build can close the environment gap at negligible measured quality cost; publishers must also release fp16, imatrix, and the per-tensor recipe.Source: §X · p. 12

ETHICAL CONSIDERATIONS

  • The study uses public repository information, reports aggregate rates rather than judgments of specific publishers, and introduces no new attack class.The named repositories are best cases whose publishers disclose more than most; the Mind the Gap procedure did not yield a working backdoor in the authors’ run.Source: ETHICAL CONSIDERATIONS · p. 12

OPEN SCIENCE

  • The released audit package includes the frozen repository list, scoring harness, audit verdicts, experiment tools, raw figure data, and rendering scripts.The inputs are public Hugging Face artifacts and pinned open-source llama.cpp builds; a Zenodo deposit is planned for the published version.Source: OPEN SCIENCE · p. 12

LLM USAGE CONSIDERATIONS

  • The authors report using LLM agents to contest model-card audit labels and a coding assistant for scripts, with deterministic scans, manual classification, and data checks as safeguards.The experiments used CPU quantization, limited perplexity evaluations, and a few GPU forward passes on open models up to 14B parameters.Source: LLM USAGE CONSIDERATIONS · p. 13

APPENDIX A PROOFS

The appendix formalizes why the execution environment must be constrained for bit-exact re-derivation and bounds the sampling needed to detect sparse tampering. Its examples show that spot-checking can become costly as tampering becomes sparser.

A. Proof of Observation 1 (necessity of E)

  • With fixed non-environment inputs, changing architecture and compiler changes the serialized quantized output, so the specification must constrain E.The tested outputs differed in k-quant weight tensors while metadata/KV bytes matched; the divergence arose in the FMA-sensitive scale-search loop.Source: A. Proof of Observation 1 (necessity… · p. 14, Appendix A · p. 14
  • Adding -ffp-contract=off made outputs bit-identical across both tested architecture/compiler pairs for four tested types, but sufficiency is established only for those environments.The authors do not claim that this coordinate suffices for untested compilers or GPUs.Source: A. Proof of Observation 1 (necessity… · p. 14
  • Specifications that omit execution-environment coordinates cannot determine the expected output for the studied scale-search artifacts without the producer’s binary and platform.The appendix cautions that missing E alone does not formally entail a zero IVR, which can also result from missing C, W, or θ.Source: A. Proof of Observation 1 (necessity… · p. 14

B. Proof of Proposition 1 (sampling bound; standard)

  • For a verifier sampling k of N units against m altered units, the detection bounds imply k = Θ(N/m).A necessary condition is k ≥ (1 − δ)N/m, while k ≥ (N/m) ln(1/δ) suffices.Source: B. Proof of Proposition 1 (sampling… · pp. 14–15
  • For a 7B model with N ≈ 2.7 × 10^7 and m = 10^2, δ = 0.05 requires k ≥ 2.6 × 10^5, while k ≈ 8.1 × 10^5 suffices.Independent Merkle paths would produce proofs of approximately 0.2–0.65 GB; the authors note that multiproofs can be smaller.Source: B. Proof of Proposition 1 (sampling… · p. 15

C. Remark

When the admissible output is unique across rebuilders’ environments, an honest rebuilder detects any different artifact, except with negligible hash-collision probability.

C. Remark

  • If B_E′(X̄) = 0, one honest rebuilder’s exact recomputation detects any Q′ ≠ T(X̄; E), except with negligible hash-collision probability.Source: C. Remark · p. 15

APPENDIX B ASSUMPTIONS AND SECURITY-CLAIM BOUNDARY

The appendix states assumptions for re-derivation and separates that primary claim from a residual attestation fallback. Its security claims depend on the benign-source setting and on whether rebuilders’ environments yield a unique output.

APPENDIX B ASSUMPTIONS AND SECURITY-CLAIM BOUNDARY

  • The framework assumes the signed source W is trustworthy, hashes are collision-resistant, the modeled inputs include potentially output-affecting coordinates, and at least one rebuilder executes faithfully.The authors leave full characterization of the necessary input coordinates open.Source: Appendix B · p. 15
  • A malicious source model, including adversarial-fp16, is not flagged by re-derivation when quantization faithfully reproduces it.This is an upstream-poisoning boundary, not a claim about detecting a cheating quantizer.Source: Appendix B · p. 15
  • TEE attestation is a residual fallback under separate assumptions; it proves an approved quantizer ran on committed inputs, not that its algorithm is correct.The paper proves no TEE security theorem.Source: Appendix B · p. 15
  • When B_E′ = 0, exact re-derivation detects deviations; when B_E′ > 0, re-derivation alone cannot decide and the measured nibble-flip floor ranges from 0.02% to 0.2% of Q4 K weights.Adaptive placement hides a bounded low-magnitude reservoir, while a targeted embedding edit evades the statistic.Source: Appendix B · p. 15
Loading 2610.19498v1…